October CMS CVE-2026-26274

Exploitation requires all of the following conditions: (1) Backend user authentication with explicit Developer role permissions to access template editor; (2) cms.safe_mode enabled in the October CMS configuration; (3) Access to Twig template markup editor or ability to inject Twig code into template files; (4) October CMS version prior to 3.7.14 (for 3.x branch) or prior to 4.1.10 (for 4.x branch). The vulnerability does NOT affect installations with cms.safe_mode disabled (non-default but commonly disabled for performance), nor does it affect users without Developer permissions. Remote unauthenticated exploitation is not possible - attackers must first gain valid backend credentials or compromise an existing developer account. This is a privilege escalation within the developer role, not a remote code execution vector.

CVSS 6.6 (High) with AV:N/AC:H/PR:H indicates moderate real-world risk constrained by multiple factors: network accessibility is present, but attack complexity is high and requires high privileges (Developer role in backend). The vulnerability is NOT actively remotely exploitable by unauthenticated attackers - it requires an authenticated backend user with explicit Developer permissions to access the Twig template editor, which typically represents a trusted administrative function. However, for organizations with weak developer access controls or compromised developer accounts, the impact is severe: attackers can read sensitive data (C:H) and modify/delete database records (I:H/A:H) affecting data integrity and availability. No EPSS score, KEV status, or public POC availability data was provided; without these signals, assessment relies on CVSS vector and privilege requirements. The AC:H rating suggests the attack path is non-trivial despite high privileges, possibly indicating complex template syntax or sandbox bypass techniques required. Real-world priority depends on developer account security posture and whether cms.safe_mode is actually enabled in production - many CMS installations disable safe_mode for performance, which would eliminate this attack vector entirely.

A developer with legitimate backend access (or an attacker who compromised a developer account) logs into the October CMS administration panel and navigates to the Twig template editor where cms.safe_mode is enabled. The attacker crafts malicious Twig template markup using the whitelisted query builder object to execute insert(), update(), or delete() methods directly on database tables, bypassing sandbox restrictions. For example, a template snippet calling query_builder.table('users').where('id', 1).delete() could remove an admin user or execute table('settings').update({'api_key': 'attacker_value'}) to modify configuration. Within minutes, arbitrary database records are altered or deleted.